zowe / sample-spring-boot-api-service

Zowe REST API service SDK and sample API service that integrates with Zowe API Mediation Layer
Other
26 stars 18 forks source link

Misleading security message in rest-api-commons #107

Open gejohnston opened 4 years ago

gejohnston commented 4 years ago

When starting a rest server as a user without proper security, you get the following error message:

2020-02-26 19:51:18.766 ERROR 393949 --- [pool-1-thread-1] .z.c.z.s.s.ZosJniPlatformSecurityService : The server user ID does not have authority to change the thread-level security. UPDATE access to BPX.SERVER in the facility resource class is required, or READ access if the user ID is superuser

It comes from this line in commons:

https://github.com/zowe/sample-spring-boot-api-service/blob/b80ce88d98d43e17649c02ca3dc2e2415c833a3e/zowe-rest-api-commons-spring/src/main/java/org/zowe/commons/zos/security/service/ZosJniPlatformSecurityService.java#L66

Our experiments have shown that a workable alternative is to assign only READ access to BPX.SERVER and UPDATE access to BPX.DAEMON.

The directions in the existing error message will work, but the message implies that is the only solution. Some customers may find the lower privilege for BPX.SERVER preferable.